WO2015119607A1

WO2015119607A1 - Resource management

Info

Publication number: WO2015119607A1
Application number: PCT/US2014/015040
Authority: WO
Inventors: Sandhya Balakrishnan
Original assignee: Hewlett-Packard Development Company, L.P.
Priority date: 2014-02-06
Filing date: 2014-02-06
Publication date: 2015-08-13

Abstract

Compare data for a first data window to historical data, compare neighboring data in a second data window to the data in the first data window, determine whether the data indicates a seasonality based on the comparison of the neighboring data to the data, and determine whether the data indicates an anomaly based on the comparison of the data to the historical data and the seasonality determination.

Description

RESOURCE MANAGEMENT

Background

[0001] Infrastructures (e.g., from a network center, datacenter, etc.)can include resource (e.g., CPU, memory, networks, etc.) management (e.g., management of applications, laaS, PaaS, SaaS, etc.). The management can include monitoring, and/or detecting anomalies in data to determine an attribute (e.g., health/performance/availability of a resource attribute such as memory usage, page scan rate run queue length, and/or network byte rate) of a data environment (e.g., datacenter, virtualized datacenter, cloud, etc.). An attribute can include resource demand in a datacenter. An attribute can include a measure and can identify resource demand in a datacenter. The resource demand and/or usage may not be uniform through a given time period (e.g., a day, a week, a month, etc.).

Brief Description of the Drawings

[0002] Figures 1 illustrates an example of a system according to the present disclosure.

[0003] Figure 2 illustrates an example of a system according to the present disclosure.

[0004] Figure 3 illustrates a flow chart of an example method for resource management according to the present disclosure. [0005] Figure 4 illustrates a flow chart of an example of a method for resource management according to the present disclosure.

[0006] Figure 5 illustrates an example of a method for resource management according to the present disclosure.

Detailed Description

[0007] Each infrastructure (e.g., from a network center, datacenter, etc.) can have different monitoring needs. A cloud environment can be dynamic and can change rapidly. A change in a cloud environment can be due to an anomaly in the data. A change in the cloud environment can also be due to seasonality (e.g., change in trend of data). An anomaly in the data can be determined by comparing current data to historical (e.g., data from a previous time period). The dynamic nature of the cloud environment can prevent a proper comparison of historical data to current data in order to determine if there is an anomaly and/or a seasonality to the data.

[0008] In a dynamically and rapidly changing environment, such as in virtualized environments and cloud technologies, data can change quickly. The quick changing data can make it difficult to distinguish an anomaly from a seasonality of the data. Changes in the data may be learned and stored and used for subsequent analysis. A subsequent change in the dynamic cloud environment can occur before an initial change is learned and a pattern is established. For example, large instances of usage by users, networks, etc. can be increased and decreased, causing unpredictable workloads. Patterns of usage can vary between days, months, and years and even seasonally (e.g., holidays, etc.).

[0009] When there is a seasonality change in an interval of data, it is likely that neighboring data samples will experience the seasonality change as well. For example, when a first interval has a slow-down in usage, a second interval that neighbors the first may also experience a slow-down of usage. Analyzing neighboring data cycles and determining a pattern can increase detection and prevent storage of large amounts of data. [0010] In the following detailed description of the present disclosure, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration how examples of the disclosure may be practiced. These examples are described in sufficient detail to enable those of ordinary skill in the art to practice the examples of this disclosure, and it is to be understood that other examples may be used and the process, electrical, and/or structural changes may be made without departing from the scope of the present disclosure.

[0011] The figures herein follow a numbering convention in which the first digit or digits correspond to the drawing figure number and the remaining digits identify an element or component in the drawing. Elements shown in the various examples herein can be added, exchanged, and/or eliminated so as to provide a number of additional examples of the present disclosure.

[0012] In addition, the proportion and the relative scale of the elements provided in the figures are intended to illustrate the examples of the present disclosure, and should not be taken in a limiting sense. As used herein, "a number of an element and/or feature can refer to one or more of such elements and/or features.

[0013] Figure 1 illustrates a diagram of an example of a system 101 for resource management according to the present disclosure. The system 101 can include a data store 103, resource management system 105, and/or a number of engines 107, 109, 1 1 1 , 1 13. The resource management system 105 can be in communication with the data store 103 via a communication link, and can include the number of engines (e.g., historical comparison engine 107, neighbor comparison engine 109, anomaly determination engine 1 1 1 , seasonality determination engine 1 13). The resource management system 105 can include additional or fewer engines than illustrated to perform the various functions described herein.

[0014] The number of engines 107, 109, 1 1 1 , and 1 13 can include a combination of hardware and programming that is configured to perform a number of functions described herein (e.g., determine whether data includes seasonality). The programing can include program instructions (e.g., software, firmware, etc.) stored in a memory resource (e.g., computer readable medium, machine readable medium, etc.) as well as hard-wired program (e.g., logic).

[0015] A historical comparison engine 107 can include hardware and/or a combination of hardware and programming to compare data in a first time window to historical data. A window of time can include an hour, a day, a week, etc. For example, data from a time window can be collected during that time window and stored for analysis. The data can include user data indicating an amount of resource (e.g., data storage, application, server, etc.) usage at a particular time (e.g., during a first window of time) during resource management. The historical data can include resource usage data from a particular time prior to the first window of data. The historical data can be from a particular time that is related to the particular time of the data (e.g., current data). For example, the historical data can be from a time period (e.g., an hour, a day, a week, etc.) that is the same as the first data window. As an example, the historical data can be from a first day of the week and the data of the first window can be from the first day of the week. Further, for example, first historical data can be from a

Monday of a first week from 09:00-10:00 hours (e.g., a one-hour time window), second historical data can be from a Monday of a second week from 09:00- 10:00 hours, and data (e.g., current data) can be from a Monday of a third week from 09:00-10:00 hours). The Monday of the third week can be a same day as the day the analysis is being performed and the historical data can be data from previous days (e.g., Mondays) of previous weeks (e.g., one week prior and two weeks prior to the current day, in this example).

[0016] A neighbor comparison engine 109 can include hardware and/or a combination of hardware and programming to compare neighboring data in a number of data windows (e.g., a second, third, and fourth data window) to data in a first data window. Neighboring data can include a time period that is close to the data's time period. For example, the data (e.g., current data) can be from 0500 hours to 0600 hours while the neighboring data can be from 0400 hours to 0500 hours.

[0017] An anomaly determination engine 1 1 1 can include hardware and/or a combination of hardware and programming to determine whether the data indicates an anomaly. The anomaly can be determined by comparing historical data to the data. The determination can include detecting a threshold deviation of the data from the historical data. For example, a threshold deviation can include 1 .5 and an historical data value can be 4 while a data value (e.g., current data value) can be 10. The data deviates from the historical data by a value of 6 and exceeds the threshold deviation. An anomaly can be detected when the threshold deviation is determined. The detected anomaly can be a possible historical anomaly in that the anomaly can be due to a seasonality. The detected possible historical anomaly can be compared to a number of seasonality indicators to determine if the possible historical anomaly is due to a seasonality or is due to an actual anomaly. In the example given, historical data can have a value of 4, which can indicate a normal value, and current data can have a value of 10, which can indicate a deviation from the historical data. The comparison of the current data to the historical data would indicate that there is an anomaly in the current data.

[0018] Figure 2 illustrates an example of a system 201 according to the present disclosure. The system 201 can utilize software, hardware, firmware, and/or logic to perform a number of functions described herein. The system 201 can be any combination of hardware and program instructions configured to share information. The hardware, for example can include a processing resource 215 and/or a memory resource 219 (e.g., computer-readable medium, machine readable medium (MRM), database, etc.). A processing resource 215, as used herein, can include any number of processors capable of executing instructions stored by a memory resource 219. Processing resource 215 may be integrated in a single device or distributed across multiple devices. The program instructions (e.g., computer-readable instructions (CRI)) can include instructions stored on the memory resource 219 and executable by the processing resource 215 to implement a desired function (e.g., determine whether data includes a seasonality).

[0019] The memory resource 219 can be in communication with a processing resource 215. A memory resource 219, as used herein, can include any number of memory components capable of storing instructions that can be executed by processing resource 215. Such a memory resource 219 can be a non-transitory CRM or MRM. Computer-readable medium may be integrated in a single device or distributed across multiple devices. Further, memory resource 219 may be fully or partially integrated in the same device as processing resource 215 or it may be separate but accessible to that device and processing resource 215. Thus, it is noted that the system 201 may be implemented on a participant device, on a server device, on a collection of server devices, and/or a combination of the user device and the server device.

[0020] The memory resource 219 can be in communication with the processing resource 215 via a communication link (e.g., a path) 217. The communication link 217 can be local or remote to a machine (e.g., a computing device) associated with the processing resource 215. Examples of a local communication link 217 can include an electronic bus internal to a machine (e.g., a computing device) where the memory resource 219 is one of volatile, non-volatile, fixed, and/or removable storage medium in communication with the processing resource 215 via the electronic bus.

[0021] A number of modules 221 , 223, 225, 227 can include CRI that when executed by the processing resource 215 can perform a number of functions. The number of modules 221 , 223, 225, 227 can be sub-modules of other modules. For example, the historical comparison module 221 and the neighbor comparison module 223 can be sub-modules and/or contained within the same computing device. In another example, the number of modules 221 , 223, 225, 227 can comprise individual modules at separate and distinct locations (e.g., CRM, etc.).

[0022] Each of the number of modules 221 , 223, 225, 227 can include instructions that when executed by the processing resource 215 can function as a corresponding engine as described herein. For example, the historical comparison module 221 can include instructions that when executed by the processing resource 215 can function as the historical comparison engine 107. In another example, the neighbor comparison module 223 can include instructions that when executed by the processing resource 215 can function as the neighbor comparison engine 109. [0023] Figure 3 illustrates a flow chart of an example method 302 for resource management according to the present disclosure. At point A 331 -1 , a number of indicators (e.g., seasonality indicators) previously stored can be used. At point A 331 -1 , if it is a first time comparing data (e.g., current data) to historical data, there may not be a seasonality indicator stored. The seasonality indicators may be determined from subsequent comparisons of data (e.g., current data) and historical data. A number of subsequent comparisons may be performed in order to store a predetermined number (e.g., three) of seasonality indicators before a seasonality determination can be performed. At point A, if it is not the first time comparing data (e.g., current data) to historical data, seasonal indicators may be previously stored and used for a current seasonality determination. The stored data can include a number of historical data points including information about usage of data resources (e.g., cloud environment usage). A seasonality indicator can include an indication of a comparison of data for a particular time window (e.g., a neighboring time window). For example, a first set of data can be compared to a second set of data. An indicator for the comparison can indicate that the first set of data deviates from the second set of data based on the comparison. The indicator can be positive when the comparison shows a deviation. The indicator can be negative when the comparison does not show a deviation. The deviation can be a threshold deviation.

[0024] At 333, the method 302 can include comparing the data (e.g., current data from a first data time window) to historical data (e.g., historical data from a first data time window of a similar period) to check for a deviation in the data from the historical data. For example, a first time window can include 09:00-10:00 hours and the data (e.g., current data) can be from a first day (e.g., a Monday) and the historical data can be from a first day (e.g., a Monday) of one-week previous. The comparison can be performed by an historical comparison engine 107 illustrated in Fig. 1 and/or a historical comparison module 221 illustrated in Fig. 2. Determining whether there is an anomaly in the current data based on a deviation in the comparison can be determined by an anomaly determination engine 1 1 1 illustrated in Fig. 1 and/or an anomaly determination module 225 illustrated in Fig. 2. The deviation can be based on a threshold deviation and/or a set or predetermined value. For example, first historical data may include a value of 100 whereas the data (e.g., current data) may include a value of 50. If the threshold is less than a value of 50, the data can be determined to deviate from the historical data.

[0025] When the data (e.g., current data) is determined to not deviate from historical data (e.g., first historical data), a seasonality indicator for the data can be saved as negative (e.g., as seasonality indicator 1 , "S1 "), at 335, and there may be no alert sent to a user. In contrast, when the data (e.g., current data) is determined to deviate from the historical data (e.g., first historical data), a seasonality indicator for the data can be saved as positive. When a

determination of an anomaly has been performed on the data (e.g., the current data), the data can be saved as historical data (e.g., second historical data) and new data can be analyzed. The new data can be compared to the first and second historical data to determine if there is a deviation. If there is no deviation, seasonality indicators for the comparison of the new data to the first historical data (S2) and the new current data and the second historical data (S3) can be saved as negative seasonality indicators. In contrast, if there is a deviation, S2 and S3 can be saved as positive seasonality indicators. The new data can be saved as the third historical data and the three seasonality indicators (S1 , S2, and S3) can be saved, at given point A 331 -2. When seasonality indicators correspond to a particular time period and a new time period renders the particular time period less useful in determining a

seasonality, the seasonality indicators can be replaced to correspond to the new time period.

[0026] When new data (e.g., a fourth data set after the first, second, and third historical data sets mentioned above) is determined to deviate from the historical data (e.g., first, second, and third historical data sets), a determination (e.g, a check), at 337, can be performed to determine if there are a number of seasonality indicators (e.g., a predetermined number, such as three above) previously stored from previous anomaly and/or seasonality determinations. In this example, the determination, at 337, would indicate that there are three seasonality indicators (e.g, S1 , S2, and S3 above). When there are not any previously stored seasonality indicators (e.g., as when the first, second, and third historical data sets were being compared because the first, second, and third historical data sets created S1 , S2, and S3), a determination about seasonality may not be determinable and a likelihood of an anomaly can be low and/or indeterminable. The detected anomaly can be ignored and/or a notification with a low likelihood (e.g. confidence) can be reported to a user. While, in this example, three seasonality indicators are used, other examples are not so limited. A seasonality indicator can include an indicator that helps to determine if there was a deviation in current data from additional data (e.g., neighboring data).

[0027] A determination, at 339, can be performed to compare data (e.g., current data) to seasonality indicators (e.g., S1 , S2, and S3) to determine if the data includes a deviation based on seasonality. The determination, at 339, can be performed by a neighbor comparison engine 109, illustrated in Fig. 1 and/or a neighbor comparison module 223, illustrated in Fig. 2. When a seasonality is detected, at 341 , the seasonality pattern from the data can be stored, at 343, in a database. The detection of the seasonality, at 341 , can be performed by a seasonality determination engine 1 13, illustrated in Fig. 1 and/or a seasonality determination module 227, illustrated in Fig. 2. The seasonality pattern and its corresponding seasonality indicators can be stored, at 331 -3.

[0028] When a deviation of the data from historical data is determined to not be attributable to a seasonality (e.g., current data does not deviate from historical data and seasonality indicators are negative), an anomaly can be detected, at 345, and a user can be notified, at 347. For example, when a determination that data (e.g., current data) does not deviate from historical data, a determination of whether this is seasonality can be performed. When the determination indicates that there is not seasonality, the anomaly can be verified. The anomaly can be stored, at 331 -3, for reference by the user.

[0029] Figure 4 illustrates a flow chart 404 of an example of a method for resource management according to the present disclosure. The method 404 can include analysis, at 451 , of current data and historical data. The current data can include data related to a resource environment (e.g., a cloud

computing environment) and its usage (e.g., amount of users accessing, amount of data input and output, processing speeds, etc.). The current data can be for a particular time window (e.g., time period). For example, the current data can be for an hour-long period (e.g., 09:00-10:00 hours). The current data can be for days (e.g., two days) and/or a particular day of the week (e.g., Monday, Monday and Tuesday, etc.). The historical data can be for particular time windows and can relate to the current data. For example, the historical data can be for an hour-long period corresponding to the current data (e.g., 09:00-10:00) but of a different time window (e.g., 09:00-10:00 a week before the current data, a month before the current data, etc.). The historical data can be for days corresponding to the current data (e.g., Monday, Monday and Tuesday, etc. of a previous week, previous month, etc.).

[0030] The data (e.g., current data) can be compared to historical data. The data can be compared to related historical data. For example, historical data during a one-hour period (e.g., 09:00-10:00 of a first week) can be compared to a related one-hour period of the data (e.g., 09:00-10:00 of a subsequent week). Based on analysis of the comparison, a determination can be made whether there is a deviation of the data from the historical data. The deviation can include a threshold deviation. For example, a threshold deviation of at least a value of 100 can be determined. When the data deviates by a value of 100 or more, the threshold is met and the data can be determined to deviate from the historical data.

[0031] In some examples, when the data (e.g., current data) deviates less than a threshold amount from the historical data, a deviation amount of the data and/or statistics of the data can be stored (e.g., memorized) at 453. The stored deviation can be used to determine whether the data exceeded a threshold deviation. The stored deviation can be used for later analysis of the data. At 455, the data can be saved as historical data and a process of analyzing new data and historical data can occur. For example, a comparison of historical data for a first time window and a second time window can create a first seasonal indicator to use with the data. When the data is analyzed and stored, at 453, the data can be compared to the historical data for a first time window to create a second seasonal indicator. The data can be compared to the historical data for a second time window to create a third seasonal indicator. New data can be compared to the first, second, and third seasonal indicator to determine when the new data includes a seasonality.

[0032] In some examples, when the data (e.g., current data) deviates by a threshold amount, a neighborhood data analysis, at 457, can occur.

Neighboring data can be compared to the data. Neighboring data can include data from a time window in close time proximity to the data (e.g., when current data is for time window 09:00-10:00, neighboring data can include 08:00-09:00, 07:00-08:00, etc.). The neighboring data can provide seasonality indicators (e.g., as in S1 , S2, and S3). A seasonality indicator can be positive when a comparison of two sets of data indicate a change based on seasonality. A seasonality indicator can be negative when a comparison of two sets of data indicate there is not a seasonality. A number of seasonality indicators can be used to determine seasonality.

[0033] A mixture of seasonality indicators (e.g., some seasonality indicators positive, some negative) can indicate a degree of variability to the seasonality and/or a likelihood of seasonality and/or anomaly in the data. The data can indicate an anomaly when the data deviates from the historical data and seasonality indicators are negative (indicating the deviation is not due to a seasonality). An identified anomaly can be notified to a user (e.g., 347 of Fig. 3). Data that is determined to include an anomaly can be marked as including an anomaly and may not used as an indicator for subsequent determinations. The exclusion of anomalies can prevent unreliable and/or erroneous

predictions.

[0034] The data can indicate a seasonality when the data deviates from the historical data and the seasonality indicators are positive. The data can indicate a degree of seasonality when the data deviates from the historical data and/or there is a mix of positive and negative seasonality indicators. A user may not be notified if seasonality is determined. A user can be notified with a likelihood of seasonality if there is a mix of positive and negative seasonality indicators. The data with an indication of seasonality can be stored, at 459, in a seasonality pattern repository for use as seasonality indicators in subsequent determinations. At 461 , new data can be analyzed and the data can be saved and stored for subsequent determinations.

[0035] Figure 5 illustrates an example of a method 506 for resource management according to the present disclosure. At 571 , the method 506 can include comparing, by a processor, current data from a time window to a number of historical data sets from a number of historical time windows. Data can be retrieved for the number of historical time windows in order to provide the number of historical data sets. A time window can include a period of time that data is collected.

[0036] At 573, the method 506 can include determining, by a processor, whether there is an historical anomaly in the current data set based on the comparison with the number of historical data sets. An historical anomaly can include an anomaly in the current data that is determined when compared to historical data. For example, when the current data deviates from at least one of the historical data sets, an historical anomaly can be determined. An anomaly can be a deviation of usage, speed, access, etc. The deviation can include a threshold deviation in order to determine a deviation in the current data.

[0037] At 575, the method 506 can include comparing, by the processor, the current data to a number of neighboring data sets from neighboring data time windows when the historical anomaly is determined. The neighboring data time windows can indicate seasonality indicators. For example, neighboring data for a first time window and neighboring data for a second time window can include a seasonality change. The seasonality indicator indicated by the neighboring data of the first time window and second time window would be positive (and negative if there was seasonality between the neighboring data). The current data can be compared to neighboring data by using the seasonality indicator of the neighboring data to determine if a deviation of the current data from historical data can be attributed to the seasonality indicator. For example, a threshold deviation of current data from at least one seasonality indicator (e.g., data from neighboring data cycles) can indicate a seasonality. When the seasonality indicators are negative and there was an historical anomaly previously detected, there can be a detection of a non-seasonality anomaly. When the seasonality indicators are positive and an historical anomaly is detected in the current data, the historical anomaly can be attributed to the seasonality.

[0038] At 577, the method 506 can include determining, by a processor, a likelihood of a non-seasonality anomaly based on a number of seasonality indicators that are positive, wherein a higher number of positive seasonality indicators indicate a lower likelihood of the non-seasonality anomaly in the current data. The likelihood of the anomaly being non-seasonality can be determined based on how many seasonality indicators are positive and negative. The greater the number of seasonality indicators that are positive, the lower the likelihood that the anomaly is non-seasonality and vice-versa.

[0039] At 579, the method 506 can include sending, by a processor, a notification of a likelihood of a non-seasonality anomaly to a user. The likelihood can be based on the number of positive and negative seasonality indicators compared to the current data and/or user input to the processor. For example, the user can indicate a threshold likelihood at which to notify the user. The user can indicate differing thresholds to indicate a number of likelihoods. The user can analyze the notification and determine whether the likelihood is a non-seasonality anomaly or a seasonality based on the analysis. Further, the user analysis can determine whether the current data is stored as historical data and whether the seasonality indicators are used for subsequent analysis.

[0040] Data can be stored and used to process data from later time windows on a rolling basis. For example, data from a previous data cycle that does not include an anomaly can be used as a baseline reference for the current cycle of data. The baseline reference and the current cycle of data can be compared. When the current data does not deviate from the baseline reference, the current cycle may not be analyzed. If the current data is within the threshold but slightly deviates, the current data can be a new baseline reference. In this way, for example, a rolling analysis can be more efficient in storing and analyzing data.

[0041] The specification examples provide a description of the

applications and use of the system and method of the present disclosure. Since many examples can be made without departing from the spirit and scope of the system and method of the present disclosure, this specification sets forth some of the many possible example configurations and implementations.

Claims

What is claimed:

1 . A system, comprising:

a historical comparison engine to compare data for a first data window to historical data;

a neighbor comparison engine to compare neighboring data in a second data window to the data in the first data window;

a seasonality determination engine to determine whether the data indicates a seasonality based on the comparison of the neighboring data to the data; and

an anomaly determination engine to determine whether the data indicates an anomaly based on the comparison of the data to the historical data and the seasonality determination.

2. The system of claim 1 , comprising determining a number of seasonality indicators based on the historical data.

3. The system of claim 2, wherein the seasonality indicators are positive a comparison of two sets of historical data of the historical data indicate seasonality and negative when a comparison of the two sets of historical data indicate no seasonality.

4. The system of claim 1 , wherein the seasonality determination engine determines there is the seasonality to the data based on seasonality indicators from the neighboring data.

5. The system of claim 4, wherein the seasonality determination engine determines there is the seasonality in response to the seasonality indicators from the neighboring data being positive.

6. The system of claim 4, wherein the seasonality determination engine determines a severity of the determination based on how many of the seasonality indicators are positive.

7. A non-transitory computer-readable medium storing instructions executable by a processing resource to cause a computer to:

compare data for a data window to historical data;

determine whether there is an anomaly, wherein the anomaly is determined when the comparison of the data to the historical data indicates a threshold deviation;

compare neighboring data in additional data windows to the data in the data window when the anomaly is determined; and

determine whether the data indicates a seasonality, wherein the seasonality is determined when seasonality indicators from the neighboring data are positive.

8. The medium of claim 7, wherein the seasonality indicators include an indication that the data deviates by a particular threshold value from a number of neighboring data cycles.

9. The medium of claim 8, wherein the instructions are executable by the processing resource to determine the seasonality by determining an importance level of the determined seasonality, wherein the importance levels include: a high importance indicated by the seasonality indicators being negative; a medium importance indicated by at least one seasonality indicator being positive and at least one seasonality indicator being negative; and

a low importance indicated by the seasonality indicators being positive.

10. The medium of claim 9, wherein a notification is sent to the user indicating at least one of a high importance and a medium importance.

1 1 . The medium of claim 10, wherein the notification of the high importance indicates a likelihood of an anomaly unattributable to seasonality in the data.

12. A method for selective control of communication, comprising: comparing, by a processor, current data from a time window to a number of historical data sets from a number of historical time windows;

determining, by the processor, whether there is an historical anomaly in the current data set based on the comparison with the number of historical data sets;

comparing, by the processor, the current data to a number of neighboring data sets from neighboring data time windows when the historical anomaly is determined;

determining, by the processor, a likelihood of a non-seasonality anomaly based on a number of seasonality indicators that are positive, wherein a higher number of positive seasonality indicators indicates a lower likelihood of the non- seasonality anomaly in the current data; and

sending, by the processor, a notification of the likelihood of the non- seasonality anomaly to a user.

13. The method of claim 12, comprising verifying the notification based on analysis sent by the user after receiving the notification.

14. The method of claim 12, comprising updating the historical data sets and the seasonality indicators by saving the current data as historical data, wherein an earliest data set of the historical data sets is not used in the comparison and the current data becomes the most recent historical data set.

15. The method of claim 14, comprising discarding seasonality indicators of the current data set without saving the seasonality indicators when the current data is determined to have the non-seasonality anomaly.